How everything works.

Notes and the envelope

A note is up to 50,000 characters of text. On your device, the note and its auto-hide setting are wrapped into a small JSON payload, then encrypted with AES-256-GCM. What gets uploaded is an envelope containing only a format version, a flag saying whether a passphrase is required, the random salt, the nonce, and the ciphertext — under 512 KiB, and unreadable without the key.

The link and the fragment key

Creating a note returns a link of the form burnpony.app/n/<22-char id>#<43-char key>. The part before the # identifies the note; the part after is the base64url-encoded 32-byte fragment key. Browsers never transmit fragments, so the key reaches the recipient's browser through the link alone and is never seen by the server. The actual encryption key is derived from the fragment key and salt with HKDF-SHA256.

Passphrases

An optional passphrase adds a second factor: it's normalized, stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations, and folded into the key derivation. The recipient is prompted for it in the viewer; guessing happens entirely in their browser and does not consume views. Share the passphrase over a different channel than the link. See adding a passphrase.

Views, expiry, and auto-hide

Each note carries a view allowance from 1 to 100 — the last allowed view deletes the ciphertext in the same database transaction — and an expiry from 1 hour to 30 days, enforced by a sweep every five minutes. Whichever limit arrives first burns the note. You can also set an auto-hide countdown (10 to 120 seconds) that re-hides the revealed text in the viewer; that setting travels encrypted inside the note, so even the server doesn't know it. See choosing views and expiry.

Read receipts

Receipts are off by default. Turned on, the viewer tells the recipient the sender will be notified before they reveal the note, the opened-at time is recorded, and your phone gets a generic push — "A note was opened." — carrying only the note ID. Up to five of your devices can register for a note's receipts. See using read receipts.

The Sent tab and early burn

Every note you create is listed in Sent with live status: views used, expiry, receipt times if enabled. Only the note ID, a management token, and your chosen settings are stored on your device — never the note text. Burn deletes the ciphertext from the server immediately; afterwards the link behaves like any other dead link. See burning a note early.

The viewer

The page recipients open is one self-contained file: no frameworks, no cookies, no external requests, a strict Content-Security-Policy, and a no-referrer policy so the link doesn't leak onward. It warns that the note self-destructs before the recipient reveals it, decrypts with the browser's WebCrypto, and is localized in 9 languages. View Source shows the whole thing.

The server

The relay at burnpony.app stores sealed envelopes and minimal bookkeeping — IDs, timestamps, view counts, receipt flags, a hashed management token — and deletes ciphertext on the last view, on expiry, or on early burn. Burned, expired, and never-existed notes are indistinguishable from outside. Creation is rate-limited using short-lived salted IP hashes rather than address logs. Full detail on the security page.

Self-hosting

Settings accepts a custom server URL, and each note remembers which server it lives on — so notes created against your own relay keep working if you switch back. The relay server's source is planned for public release; until it ships, self-hosting is a capability the app supports rather than something you can deploy from a public repo today. The roadmap tracks that honestly.

Limits at a glance

Note size: 50,000 characters. Envelope size: 512 KiB. Views: 1–100. Expiry: 1 hour, 8 hours, 1 day, 3 days, 7 days, or 30 days. Auto-hide: off, 10, 30, 60, or 120 seconds. Creation: rate-limited per hour per (hashed) address.